ShinyHunters claim breach of Florida's "DAVID" DMV database

The extortion group ShinyHunters has claimed it breached the online platform of the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) database known as DAVID, stealing more than 200,000 of the state's driver records.

DAVID (Driver and Vehicle Information Database) is an internal database used by law enforcement and government officials to look up information on a specific driver. According to the description on the FLHSMV website, the system provides instant access to driver and vehicle data and serves as the primary mechanism for reporting fatal and serious-injury crashes.

The proof and the scale of the leak

To back up the breach, the attackers published a screenshot of Jeffrey Epstein's record in the DAVID system. It includes an address, Social Security number, date of birth, driver's license identifier, issue and expiration dates, and registered vehicles. The system also has tabs with the license transaction history, addresses, insurance, previous vehicles, and parking permits.

Last night, ShinyHunters added FLHSMV to their leak site and threatened to publish the data if the agency does not enter into negotiations.

How the breach happened

According to ShinyHunters representatives, they got into DAVID through a vulnerability in the password reset mechanism, which allowed them to compromise several accounts — reportedly those of DMV employees and one FBI agent. Once inside, the attackers iterated through records by their identifiers and downloaded the associated HTML pages and images. By their account, this is how they managed to pull more than 200,000 records starting September 3.

The group now claims it has already lost access to the database, and the password reset vulnerability is being patched. BleepingComputer has reached out to FLHSMV and the FBI for comment.

According to the outlet's source, the attackers are also targeting the DMV platforms of other states using social engineering techniques. Asked about new targets, ShinyHunters said they expect to announce other breaches in the coming weeks.

Who are ShinyHunters

ShinyHunters is an extortion group specializing in stealing data from web applications and cloud SaaS environments. The name has been used by various actors since 2018, and over the past year it has become one of the most prominent in attacks on companies around the world. The group has been linked to breaches of Google, Cisco, PornHub, and Match Group, as well as to the attack on Instructure Canvas in May. More recently, its members have turned to voice phishing (vishing), impersonating IT support to trick employees at Okta, Microsoft, and Google into handing over credentials and multi-factor authentication codes.

Source: Bleeping Computer